Privacy Policy

Scope

This policy applies to Gosho Bundles services provided through the Shopify platform, including embedded app interfaces, theme extension functionality, and analytics ingestion endpoints used by the app.

Data Categories We Process

• Store and app installation identifiers for authenticated use.
• Order-linked attribution data, including order IDs and customer IDs where provided by Shopify webhook payloads.
• Bundle interaction and checkout attribution events needed for reporting and app performance analysis.
• Technical logs needed for debugging, reliability, and support.

Purpose Limitation

We use personal data only for the purposes selected in Shopify protected customer data settings:

• App functionality: to operate bundle offers, synchronize discount behavior, and maintain app operations.
• Analytics: to measure attributed bundle performance and generate merchant-facing analytics.

Gosho Bundles does not sell customer data.

Website Advertising Measurement

We use Google Analytics on public pages to measure visits and clicks to our app listing. We keep approved campaign tags and the referring site's origin, while filtering authentication details and unknown query parameters from the page address we send. Google advertising identifiers are retained and passed to Shopify only with your permission. Google Consent Mode defaults analytics and advertising storage to denied; before permission, Google may receive limited measurement pings without analytics or advertising cookies. Personalized advertising and Google Signals are disabled.

On public gosho.app pages, we use the Meta Pixel with your permission to measure page visits and clicks through to our Shopify App Store listing. Meta may receive the page URL, advertising click identifier, browser and device information, and IP address. We do not enable automatic form-data matching. The pixel is not loaded on the embedded app or authentication pages.

Your advertising cookie choice is remembered for up to 180 days. With permission, campaign identifiers are retained for up to 30 minutes in this browser tab and passed to our Shopify listing. Shopify can report listing visits, install-button clicks, and completed app installs to Google Analytics and Meta through its listing integration. Declining cookies on gosho.app does not set your preferences on Shopify; use the cookie controls on Shopify to manage them.

You can accept or reject these cookies, or withdraw your permission, using Cookie settings in the footer. We respect the Global Privacy Control signal. See the Meta Privacy Policy and the Google Privacy Policy for how these services handle this information.

Optional Reddit Install Measurement

After a new merchant connects and activates Gosho, we may ask for permission to share a one-time Sign Up event with Reddit to measure our advertising. If you select Allow once, Reddit receives the time of the connection, an opaque event identifier, your IP address and browser user agent, and the fixed URL https://gosho.app/app. We do not include your store domain, email, customer or order data, or Shopify authentication details in this event.

This choice is optional. Selecting No thanks has no effect on app access. We respect Global Privacy Control, and do not share this event without permission. The choice is stored for the installation to prevent repeated requests and duplicate events. IP and browser match data in our delivery queue is removed when delivery succeeds or retries are exhausted; events older than seven days are not sent. No Reddit browser pixel is loaded inside the app.

See the Reddit Privacy Policy for how Reddit handles this information. To ask us about your recorded choice or request deletion, contact support@gosho.app.

Retention Periods

• Installation and session data is retained while needed to operate the app and support the merchant installation.
• Order-linked attribution and analytics data may be retained to provide merchant reporting, billing reconciliation, support, and compliance workflows.
• Technical logs are retained for shorter operational periods used for debugging, reliability, and abuse prevention.
• We review deletion or anonymization based on operational, legal, and Shopify compliance requirements.

Uninstall and Deletion Handling

After app uninstall or a Shopify shop redaction request, shop installation data is removed and shop-linked app records are cleaned up through uninstall or redaction workflows. Customer-specific data requests and redaction requests are handled through Shopify privacy compliance webhooks.

Security Controls

• Encryption in transit is enforced through HTTPS and TLS for app traffic.
• Data at rest is protected by managed infrastructure security controls.
• Access is limited to operational use needed to provide app functionality and support.

Shopify Compliance Webhook Support

Gosho Bundles receives and processes Shopify privacy compliance webhook topics:

• customers/data_request
• customers/redact
• shop/redact

Data Rights and Requests

For privacy questions, customer-data requests, or merchant support, contact support@gosho.app.

Policy Updates

We may update this policy as product and legal requirements evolve. Material changes are reflected on this page.